Reference
Security dictionary
Short definitions for WordPress security terms. Use these when a guide gets into jargon, or skim by category when you are learning the landscape.
Browse by category
Attacks
Common ways WordPress sites get hit.
- Backdoor A backdoor is hidden access an attacker leaves so they can return without the original vulnerability.
- Brute force A brute-force attack tries many passwords or tokens until one works, usually against the login form.
- Credential stuffing Credential stuffing replays usernames and passwords stolen from other breaches against your login.
- Cross-site scripting (XSS) Cross-site scripting (XSS) injects malicious JavaScript into pages that other users’ browsers will run.
- CSRF CSRF tricks a logged-in browser into sending a request the user did not mean to send.
- DDoS A DDoS attack floods a site or its infrastructure with traffic so legitimate visitors cannot get through.
- Malware Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.
- Phishing Phishing tricks people into handing over credentials or installing malware by impersonating a trusted party.
- SQL injection SQL injection tricks a database query into running attacker-controlled SQL, often through unsafe input handling.
- Webshell A webshell is a small script uploaded to the server that lets an attacker run commands through the browser.
Access
Logins, roles, and who can do what.
- Least privilege Least privilege means each user and integration gets only the access required for their job, nothing more.
- Privilege escalation Privilege escalation is gaining higher access than intended, such as a subscriber becoming an administrator.
- Session hijacking Session hijacking steals or guesses a valid session so the attacker acts as the logged-in user.
- Two-factor authentication (2FA) Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- WordPress user roles User roles group capabilities that decide what each account can do in WordPress, from reading to full admin.
Hardening
Controls that raise the cost of an attack.
- File integrity monitoring File integrity monitoring checks whether important files changed compared with a known-good baseline.
- Rate limiting Rate limiting caps how often an action can happen from an IP or account, which slows automated abuse.
- Security hardening Hardening is the set of configuration and process changes that make a site harder to abuse.
- SSL/TLS SSL/TLS encrypts traffic between browsers and your server so passwords and cookies are harder to sniff.
- WordPress WAF A WAF filters HTTP traffic to block common web attacks before they reach WordPress.
Monitoring
Finding issues before they become incidents.
- Event logging Event logging records security-relevant actions so you can see what changed and when.
- False positive A false positive is an alert that looks like a problem but turns out to be benign after review.
- Security audit A security audit is a structured review of a site’s risks, misconfigurations, and recommended fixes.
- Vulnerability A vulnerability is a weakness in software that attackers can abuse to break confidentiality, integrity, or availability.
Mentality
How to think about risk without the theater.
- Assume breach Assume breach means designing as if an attacker may already have a foothold, so detection and recovery matter as much as prevention.
- Defense in depth Defense in depth stacks multiple controls so one missed update or weak password is less likely to end in disaster.
- Security theater Security theater is activity that feels protective but does not meaningfully reduce real risk.
- Zero trust Zero trust treats every request as untrusted until verified, and limits what any one identity can reach.
WordPress-specific
Terms that only make sense on WordPress.
- Login protection Login protection is the set of controls that harden the WordPress login against bots and credential attacks.
- Plugin supply chain Plugin supply-chain risk is when trusted plugin code or updates become a path for attackers.
- wp-config.php wp-config.php holds database credentials, keys, and core WordPress settings for the site.
- XML-RPC XML-RPC is an older WordPress API endpoint attackers often abuse for brute force and amplification.